by the Global Infrastructure Team, United Methodist Communications
Every agent has a cover story, and so does every bad actor. This Cybersecurity Awareness Month, we want to help you and your church see through the stories that cybercriminals tell.
Today's scammers do their homework. They study social media, church and company websites, public records, and past data breaches before they ever reach out. By the time a message lands in your inbox or a call rings your phone, the request can look familiar and legitimate. The Cybersecurity and Infrastructure Security Agency (CISA) warns that revealing too much online can hand criminals the details they need to phish you specifically (CISA, n.d.-a). For churches that share staff names, ministry leaders, and event details publicly, that is worth keeping in mind.
Earlier this year, United Methodist Communications published Cybersecurity basics for church communicators, which covers the fundamentals of phishing, passwords, and account security (United Methodist Communications, 2026). This article builds on it, focusing on newer tricks and what to do when something looks wrong. The defense is still simple: slow down, verify, and speak up.
Spot the cover story
A believable story is the most common tool in a scammer's kit. The person contacting you may claim to be your pastor or supervisor asking for a quick favor, a payroll contact who needs you to "confirm" direct-deposit details, a tech support caller who needs to "fix" your account, a church member or coworker asking for urgent help, or a bank verifying your account.
The story changes, but the tactic is the same. It's called pretexting: the attacker invents a believable scenario and impersonates someone you trust, hoping you will act before you have time to think. Look for these red flags:
- Urgency. "I need this payment processed right now." "Your account will be disabled unless you act now."
- Secrecy or bypassed processes. "This is confidential. Don't involve anyone else." Requests that skip normal procedures or discourage verification.
- Unusual requests. Payment or banking changes, shared passwords, multi-factor authentication (MFA) approvals, or sensitive information.
- Details that don't quite match. Unexpected email addresses, slightly altered names or domains, an unfamiliar writing style, or explanations that shift.
CISA's phishing guidance lists the same signs: urgent or emotional language, requests for personal or financial information, and incorrect email addresses or links (CISA, n.d.-a). The Federal Trade Commission (FTC) adds that requests to wire money, send cryptocurrency, or buy gift cards can be signs of a scam, because those payments are hard to get back (FTC, 2023). Gift card requests that appear to come from a pastor are a familiar version of this scam in churches.
When a request creates pressure, pause and ask yourself three questions. Is this request unusual? Does it follow our normal procedures? Can I verify it independently? To check, use a trusted method: call the person at a known phone number or send a message through a channel you already use, and don't use the contact details in the suspicious message (CISA, n.d.-a).
No true emergency requires bypassing security. A legitimate request can survive a brief verification, so you are always allowed to pause and confirm before acting.
Seeing and hearing isn't believing
Artificial intelligence (AI) now lets criminals make strangers look and sound like people you know. Deepfake videos and cloned voices can imitate a coworker, pastor, church leader, vendor, or family member, and they are often used to demand an urgent payment, a banking change, a password reset, or a break from normal procedure. The Federal Bureau of Investigation (FBI) reports that criminals use AI-generated video for live chats with people posing as company executives or authority figures, and AI-generated audio to impersonate relatives in a crisis (FBI, 2024). The FTC warns that a scammer may need only a short audio clip posted online to clone a voice (FTC, 2023). Recorded sermons and livestreamed worship services put plenty of pastors' voices online.
Some clues can give a fake away (FBI, 2024):
- An unexpected video call or message
- Poor lip synchronization or unusual facial movements
- Audio or video glitches that seem unnatural
- Odd phrasing, strange pacing, or answers that sound scripted
- Trouble answering unexpected questions
These clues can be hard to spot, and the FBI notes that AI-generated content is difficult to identify (FBI, 2024). Rely on process instead of appearance. Apply the same verification rule to anything involving money, payroll, gift cards, account access, or sensitive information: hang up and call back on a known number, or send a message, before you act (FBI, 2024; FTC, 2023).
Pro tip: Consider agreeing on a private code word or verification question with your church staff, finance team, or family, something only the real person would know (FBI, 2024). Ask it when a request feels off.
One key isn't enough
A password alone is no longer enough. Criminals steal passwords through phishing, data breaches, malware, and social engineering, which is why MFA adds a second checkpoint (CISA, n.d.-b). Attackers know this, so they now go after the second checkpoint too.
Two habits keep it strong:
- Never approve an MFA request you didn't start. Attackers fire off prompt after prompt, hoping someone approves one out of fatigue, a technique CISA calls MFA fatigue or push bombing (CISA, 2022). Deny it and report it right away, because a prompt you didn't trigger can mean your password is compromised (CISA, 2022).
- Never share a code. No legitimate support team will ask for your password or verification code, whether by phone, email, text, or chat.
If you see something, say something
An early tip-off can be the difference between a minor issue and a major incident. Your login is a gateway to everything your account can reach, including sensitive email, member information, and shared files, and an attacker can use it to impersonate you. CISA describes one case in which a hacked email account opened the door to linked bank and shopping accounts (CISA, n.d.-b). Attackers often leave clues along the way, and what looks insignificant to you may be the missing piece.
Make sure everyone on your staff and volunteer team knows who handles technology concerns for your church, whether that is a staff member, a trusted volunteer, or an outside IT provider. Then encourage them to report:
- Suspicious emails, texts, messages, or phishing attempts
- Unexpected password reset requests or MFA prompts they didn't initiate
- Unfamiliar login notifications or unusual account activity
- Suspicious phone calls or requests for sensitive information
- Unexpected attachments, links, or pop-ups claiming a computer is infected
- Anything that simply doesn't feel right
No one needs to be sure, and no one is expected to be a security expert. It is better to check ten harmless reports than to miss one real attack. If you catch yourself thinking "it's probably nothing," report it anyway.
Once a concern is reported, your tech contact can investigate, block malicious senders, secure accounts, check affected devices, and alert others if needed.
Made a mistake? Call for backup
If you clicked a link, opened an attachment, or entered information on a suspicious site, report it immediately. The sooner someone knows, the faster the threat can be contained.
- Use your email program's report phishing or report junk option on suspicious messages.
- Tell your church's tech contact right away if you think you clicked something suspicious.
- If you entered a password, change it and make sure MFA is turned on for that account.
If money was lost to fraud, you can also file a report with the FTC at ReportFraud.ftc.gov (FTC, 2023) and the FBI's Internet Crime Complaint Center at ic3.gov (FBI, 2024).
Verify the person, the request, and the process
Whether a request arrives by email, phone, text, or video, the habit that protects you is the same: verify the person, verify the request, and verify the process.
Protecting your church's accounts is part of caring for the people and ministries you serve. Share these tips with your staff and volunteers this month, and when in doubt, call for backup.
References
Cybersecurity and Infrastructure Security Agency. (n.d.-a). Recognize and report phishing. Secure Our World. https://www.cisa.gov/secure-our-world/recognize-and-report-phishing
Cybersecurity and Infrastructure Security Agency. (n.d.-b). Turn on MFA. Secure Our World. https://www.cisa.gov/secure-our-world/turn-mfa
Cybersecurity and Infrastructure Security Agency. (2022). Implementing number matching in MFA applications [Fact sheet]. https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf
Federal Bureau of Investigation. (2024, December 3). Criminals use generative artificial intelligence to facilitate financial fraud (Alert No. I-120324-PSA). Internet Crime Complaint Center. https://www.ic3.gov/PSA/2024/PSA241203
Federal Trade Commission. (2023, March 20). Scammers use AI to enhance their family emergency schemes. Consumer Advice. https://consumer.ftc.gov/consumer-alerts/2023/03/scammers-use-ai-enhance-their-family-emergency-schemes
United Methodist Communications. (2026). Cybersecurity basics for church communicators. ResourceUMC. https://www.resourceumc.org/en/content/cybersecurity-basics-for-church-communicators